Trustworthy Cyber-Physical Pipelines

In Cyber-Physical Systems (CPS), applications normally are developed by a sequence of communicating tasks (pipelines). When these constraints are critical due to the nature of the application (such as in robotics or automotive), it is necessary to ensure that the communication happens within given time bounds and that, in presence of faults, the overall degradation is controlled.

In this project, we are setting up an international team of well known experts in the field of real-time and control systems to address the above mentioned challenges. The team is composed by a mixture of senior and junior researchers and PhD students. We aim at investing most of the project resources on the young participants to expose them to an international working environment in an early stage of their career.

The primary objective of this project is to establish a robust framework to ensure the safe operation of cyber-physical systems. Safety should be guaranteed covering a spectrum of faults, including those affecting single tasks and their associated communication channels, as well as more complex scenarios involving the failure of task pipelines.

In November 2025, we organized a Workshop on End-to-End Analysis and Optimization of Task Chains (https://trust-cpp.di.unito.it/workshop2025/) in Turin, brings together leading researchers and practitioners to explore the latest methods for analyzing and optimizing task chains across a variety of domains, mostly in connection with cyber-physical systems. The program was structured around key themes highlighting both foundational theory and applied techniques. By addressing challenges such as end-to-end latency, determinism, and efficient system design, the workshop aimed to provide a comprehensive view of current advances and open questions in this area. With contributions spanning from formal models to practical analysis tools, the sessions were designed to foster in-depth discussion and encourage cross-domain perspectives on how to tackle the complexity of modern real-time systems.

In December 2025, as a result of the project, we published a paper at RTSS that introduces a new way to analyze how timing variability (jitter) propagates through chains of real-time tasks that communicate via shared memory. Task chains are a foundational abstraction in domains such as robotics, automotive systems, and cyber-physical systems, yet existing timing analyses largely assume fixed or perfectly periodic read/write behavior. This paper challenges that assumption by treating jitter as a first-class modeling element. The paper proposes a novel event-based model that explicitly represents jitter in both read and write operations, decoupling communication timing from task scheduling. Instead of tying communication strictly to task releases or completions, the model captures bounded uncertainty in when data is read and written, enabling analysis of realistic execution effects such as execution-time variability, interference, network delays, and mid-execution data access.

Pipelines of tasks are ubiquitous. From automotive to avionics, a standard pattern for processing data and take decision is to read some input (possibly measuring some environmental variable), process the data, and the write to the output (possibly by actuating over the external environment). When these pipelines operate in a safety critical environment, the assurance of a correct functioning is of vital (in the true meaning of the term) importance. However, a correct prediction of delivery is not easy.

As an example of the jeopardy of the problem, in 2021 NASA reported an anomaly during the sixth flight of the Ingenuity helicopter of the Mars Perseverance rover. While in the air, Ingenuity began adjusting its velocity and tilting back and forth in an oscillating pattern. Ingenuity used a pipeline of sensor data, that include inertial measurement units and cameras to estimate its position.

Quoting from the report: "Approximately 54 seconds into the flight, a glitch occurred in the pipeline of images being delivered by the navigation camera. This glitch caused a single image to be lost, but more importantly, it resulted in all later navigation images being delivered with inaccurate timestamps. From this point on, each time the navigation algorithm performed a correction based on a navigation image, it was operating on the basis of incorrect information about when the image was taken. The resulting inconsistencies significantly degraded the information used to fly the helicopter, leading to estimates being constantly corrected to account for phantom errors. Large oscillations ensued."

In the project, we work on verification techniques for cyber-physical systems and make them available through open source tools. The basic research behind the project requires a significant innovation that is far from obvious to establish, because of the intertwining of discrete and continuous dynamics, as well as involving the timing of the computations.